CVE-2026-12410

HighCVSS 7.8/10Last modified Oct 23, 2026

Description

Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction created during application uninstallation, which CCleaner follows when deleting the application's data folder with elevated integrity.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Gen Digital	CCleaner	< 7.10.1464

References

https://www.gendigital.com/us/en/contact-us/security-advisories/

Timeline

Published: Aug 5, 2026
Last modified: Oct 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-124119.6Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite a CVE-2026-124137.5An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of CVE-2026-124159.8The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edi CVE-2026-124169.8The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0.CVE-2026-124179.8The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeov CVE-2026-1241707.5Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1241748.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1241768.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1241786.5Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-1241796.5Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-124185.3The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable t CVE-2026-1241836.5Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.